candoxa[.]xyz

This domain, candoxa.xyz, is identified as a fraudulent phishing site targeting users through a fake NFT pass giveaway scheme. Analysis indicates the site was designed to deceive visitors into believing they could claim a limited-edition non-fungible token (NFT) pass, likely as a pretext for harvesting sensitive credentials, wallet private keys, or personal information. The page title, 'Candoxa NFT Pass Giveaway,' directly aligns with common social engineering tactics used in cryptocurrency-related scams, where urgency and exclusivity are exploited to bypass user caution. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with newly created malicious domains. It resolves to the IP address 172.67.176.233, which is part of a content delivery network known for obfuscating the true origin of malicious sites. Detection metrics further substantiate the threat: VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, confirming its classification as a phishing resource. Users who visited candoxa.xyz should take immediate remedial actions to mitigate potential exposure. If any credentials, wallet addresses, or personal data were entered on the site, those details should be considered compromised and changed immediately across all platforms where they were reused. Cryptocurrency wallet users are advised to transfer assets to a new wallet and revoke any connected dApp permissions associated with the compromised address. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered. Future vigilance is critical, particularly when engaging with unsolicited offers or giveaways in the digital asset space.